Since being consumer products these LNBs provide only moderate frequency accuracy and stability. Below we will describe how to modify these LNBs to achieve superior accuracy and stability with relatively little effort.

The LNBs have the usual 13V/18V V/H polarization selection and come with a dielectric plate to achieve circular polarization.

Let's take a look inside...

C1WPLL - Single channel LNB with one RDA3570 and one crystal. Yes, some screws are missing and the holes are going through to the feed, which will allow moisture to enter the LNB!

C2WPLL - Dual channel LNB with two RDA3570 sharing one crystal. Better to buy this one since it has all screws in place!

On both pictures we see a 25 MHz crystal providing reference to the microwave PLL running at 5150 MHz inside the RDA chip. The resulting IF range is between 1650-950 and 1450-950 MHz. Please note, the high LO design inverts the baseband, so you have to swap the I and Q signals before further processing.

To check the frequency error we lock the signal generator and spectrum analyzer to a 10MHz GPSDO source and inject 3500 MHz at very low level into the LNB's feed opening while observing the down converted signal at 1650 MHz (5150 MHz LO - 3500 MHz RF).

In the picture below we see how the moderate frequency accuracy of the cheap crystal results in a carrier offset of almost 70 kHz.

Now with 25MHz reference (after the hardware mod. described below) locked to 10MHz provided by the same GPSDO source which is used by the signal generator and spectrum analyzer. Now the carrier appears exactly where we would expect it.

For comparison: in the picture below only a cheap PLL frequency multiplier was used, so you can clearly see the effect of the bad phase noise of the reference also having a huge impact on the noise floor around the signal of interest.

The modification comes down to removing the stock crystal and feed 25 MHz from a stable frequency source into the LNB.

We have at least the following options:

Drill a hole and provide the reference signal via a dedicated coaxial cable

Use the same coax for reference clock as being used for IF and DC power

In both cases, don't forget to seal the connector(s) against moisture.

Since the first option is trivial, lets discuss the second option below.

The original IF connector also carries the LNB supply voltage (DC, 13 or 18V). We have to isolate the 25 MHz signal while blocking DC and IF signals at the same time. The proposed approach is using a simple narrow bandpass made of a series capacitor and inductor. Here we've chosen the following values to achieve resonance at 25MHz: 82pF + 500nH. Any other reasonably selected value pairs which are resonant at 25 MHz might be used as well.

Carefully remove the crystal without destroying the PCB pads. Proceed as shown on the picture below.

With this modification, experiments have shown that reference level must be maintained between -20 to 10 dBm for best SNR. The PLL does not lock below -40dBm and the SNR degrades above 10dBm. Best reference level appears to be around -10 dBm.

To inject the 25 MHz signal on to the coax going to the LNB, we use a Mux Tee from Orbital Research, which essentially is a bias-t with additional BNC connector for injection of a reference signal for a block up converter (BUC).

Let's take a look inside. You see a bunch of highpass and lowpass filters with the 10 MHz signal being injected into the DC lowpass.

Measurements show approx 0.4dB attenuation at 10MHz, 1.8dB at 25MHz, 3dB at 50MHz. The 433MHz path of this specific model used for communication with the BUC has at least 22 dB of attenuation.

Of course you can use any other SAT bias-t and modify it to inject the 25 MHz signal using same capacitor & inductor values we've used before inside of the LNB in order to extract the reference signal.

In the following examples we've used G3RUH GPSDO, which provides a very clean square wave output signal at 5V amplitude.

To be able to lock the LNB to the GPSDO, we have to produce a clean 25 MHz signal from the 10 MHz provided by GPSDO. Of course we might build an external PLL board, but let's see first what else we can use.

Let's see how we can use our HackRF Jawbreaker with serial number 1 (Thanks Michael!).

The HackRF SDR transceiver has a clock input, which allows it to be locked to an external 10 MHz reference (must be present when switching on HackRF) and a clock output which by default outputs 10 MHz. To let the output produce 25 MHz instead of 10 MHz, in hackrf_core.c replace the line

Since AirSpy is using the same clock distribution IC as hackrf (si5351c) and has just like the hackrf a 10 MHz external reference input as well as 3 clock outputs (not used at the moment), the approach used above might work as well, but this has not been tried yet.